Soup Sieve versions starting from 3.2.0 are vulnerable to a polynomial-time denial of service (DoS) via selectors using descendant combinators. The matching time grows polynomially with document nesting depth, causing excessive CPU usage on deeply nested untrusted HTML or XML inputs. This issue is fixed in version 4.0 by caching intermediate matching results, reducing complexity to linear time.